Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 10:57

General

  • Target

    e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    e9d5206109ad1c3a34b863fa42ee6e40

  • SHA1

    6543398463a12685648d4a5876965bee3af17b5c

  • SHA256

    c3e1f7bd5dfa81bb5c55a12d804184f0ae5607bbe5a191ba4984c5cd36d89da2

  • SHA512

    c4df9ec3d8b7b4b9fc3e8b29a0c49911b84faa5a805329e583d70099e1335a4337781d7278376d8db8f52eb31ec07b2e2db6bc9fc278075eb0c8c4bd239a0998

  • SSDEEP

    49152:LXenjmTRNtf1ihnlxlF2H6dfqS3q6o7h0D9kPV969oHZGrGeXa2cyM1bKzNqAfn3:LXs8tf0xlzJxo7hi9cbZPk4bKnP3

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:3568
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:556

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3568-0-0x00000000005E0000-0x0000000000E78000-memory.dmp

            Filesize

            8.6MB

          • memory/3568-1-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-2-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-3-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-4-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-6-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-5-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-7-0x0000000077814000-0x0000000077816000-memory.dmp

            Filesize

            8KB

          • memory/3568-11-0x00000000005E0000-0x0000000000E78000-memory.dmp

            Filesize

            8.6MB

          • memory/3568-12-0x00000000060C0000-0x00000000066D8000-memory.dmp

            Filesize

            6.1MB

          • memory/3568-13-0x0000000005A30000-0x0000000005A42000-memory.dmp

            Filesize

            72KB

          • memory/3568-14-0x0000000005AA0000-0x0000000005ADC000-memory.dmp

            Filesize

            240KB

          • memory/3568-15-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

            Filesize

            304KB

          • memory/3568-17-0x00000000005E0000-0x0000000000E78000-memory.dmp

            Filesize

            8.6MB

          • memory/3568-18-0x0000000005C80000-0x0000000005D8A000-memory.dmp

            Filesize

            1.0MB

          • memory/3568-19-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-20-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-21-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-22-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-24-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB

          • memory/3568-25-0x0000000077600000-0x00000000776F0000-memory.dmp

            Filesize

            960KB